A new international standard, ISO/IEC 27090, was recently published to help organizations understand threats to AI systems and their potential consequences. It also outlines measures to detect and mitigate these threats.
Although the standard is written for organizations, many of the decisions involved are made by development teams. For example, the way an application manages prompts and processes model outputs can affect its security.
SecureFlag has created a course that gives developers hands-on experience with many of the AI security threats described in the standard.
What is ISO/IEC 27090?
Published on October 14, 2026, ISO/IEC 27090 provides guidance rather than a set of requirements. It focuses on protecting AI systems from attack, and its scope is not limited to generative AI or chatbots. It doesn’t cover the use of AI to defend other systems.
It was developed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), the organizations behind the ISO/IEC 27000 family of information security standards.
According to ISO’s overview, the standard is intended for organizations of all sizes that develop or use AI, including businesses, public bodies, and not-for-profit organizations.
Threats specific to AI systems
ISO’s overview describes the following types of threats, among others.
-
Data poisoning: Manipulating data used to train or update a model so that it behaves incorrectly.
-
Model exfiltration (also known as model theft or extraction): An attacker attempts to recreate a model by supplying inputs and observing its outputs.
-
Evasion attacks: Specially crafted inputs that cause an AI system to produce incorrect or unintended results.
-
Membership inference and model inversion: Techniques that can reveal whether particular data was used to train a model or help reconstruct information from its training data.
-
Direct model poisoning: Manipulating the model itself rather than the data used to train it.
-
Input and output attacks: These include prompt injection and output injection, where a model’s output is passed to another system that trusts it and acts on it unsafely.
Something ISO emphasizes is that data collected while a system is running can later be used to update or retrain the model. If that data has been corrupted, vulnerabilities can carry into future versions of the system.
When models are compromised, they could leak sensitive information or give misleading results. People’s safety could also be put at risk when these results are used, for example in areas such as healthcare or transportation.
Updating a model or adding a new data source can create new openings for attackers, which is why ISO describes protection as something to maintain across the AI life cycle.
How does ISO/IEC 27090 relate to other ISO standards?
ISO/IEC 27001 sets requirements for an information security management system, while ISO/IEC 27002 offers guidance on security controls.
ISO/IEC 27090 builds on the practices covered by both standards. It explains how they apply to AI systems and where models, training data, and machine learning pipelines need extra protection.
ISO/IEC 42001 focuses on how organizations manage the risks and opportunities that come with AI. Security is one part of that work, so ISO/IEC 42001 and ISO/IEC 27090 serve different purposes. They complement each other, and neither replaces the other.
What areas does the guidance cover?
The guidance is organized around three connected areas.
-
Applying information security to AI systems: Looks at how established security practices apply to AI, including governance, zero trust, and secure software development. It also covers threat modeling and red teaming. Threat modeling analyzes a system’s design, and red teaming tests the running system, both from an attacker’s perspective.
-
Understanding AI-specific threats: Explores the risks AI systems face, the impact these threats can have, and how teams can detect and address them. It also looks at controlling unwanted model behavior and tracing where AI systems and their data come from.
-
Maintaining protection over time: Covers how to monitor AI systems for suspicious activity and find malicious inputs. It also looks at how safeguards can become less effective over time or interfere with one another.
The overall approach is defense in depth, meaning several layers of protection, with the understanding that some AI threats remain difficult to detect.
ISO/IEC 27090 for development teams
The standard highlights several areas development and security teams may want to look at.
Threat modeling
Threat modeling helps teams identify what attackers might target and reduce risks before deployment.
For AI systems, teams should take into account training data, models, third-party components, and connections to other systems. They should also assess risks such as data manipulation and malicious inputs, and revisit their threat models as systems change.
Software engineering practices
AI-driven applications still need secure development practices. Even when the model is well protected, weaknesses in an application’s APIs, dependencies, authentication, or data handling can still leave it exposed.
Developers should account for AI-specific risks, such as prompt injection, particularly when applications pass untrusted content to models or let models interact with other systems.
Supply chain security
AI systems often depend on third-party models, datasets, libraries, and tools. Vulnerabilities or tampering in any of these components can affect the wider system.
Tracking where components and data come from, how they change, and whether their integrity can be trusted helps teams assess risks and investigate suspicious behavior.
Practical starting points
Organizations preparing to use the guidance can begin with the following steps, which are adapted from ISO’s overview.
-
Identify the AI systems the organization develops or uses, including those supplied by third parties.
-
Document where data and models come from and how they change during operation or retraining.
-
Bring cybersecurity, AI development, data, and procurement teams together for the same discussion.
-
Review current security practices to find where AI-specific threats need closer examination.
-
Decide how suspicious behavior would be detected and who would respond.
The ISO/IEC 27090 course
SecureFlag has created a course to help developers put the standard’s guidance into practice. It focuses on Clause 6, which describes threats specific to AI systems, and helps developers understand how these threats can affect the applications they build and maintain.
Learners work through reading material and interactive labs. In the labs, they carry out attacks against AI applications and then fix the weaknesses that allowed them. The course covers many of the threats described earlier in this post, such as data poisoning and prompt injection.
How SecureFlag supports AI security
The course is only one way SecureFlag helps teams apply the standard. ThreatCanvas, SecureFlag’s automated threat modeling solution, generates threat models in seconds, helping teams identify risks during design, before code is written. It also includes pre-built risk templates for AI-related threats covered by OWASP guidance.
For security issues that arise during development, SecureFlag offers hands-on labs covering different aspects of AI security and secure coding.
-
AI security labs include the OWASP Top 10 for LLM Applications, the OWASP Top 10 for Agentic Applications, RAG systems, and more.
-
Agentic Coding Labs help developers practice secure prompting, review AI-generated code, fix vulnerabilities, and build secure agents and Model Context Protocol (MCP) integrations.
ISO/IEC 27090 helps organizations understand the threats they need to address. SecureFlag gives developers practical ways to learn about these threats and work through security issues in AI applications and AI-generated code.
